Fluent Support – Helpdesk & Customer Support Ticket System <= 2.4.0 - Authenticated (Support Agent+) Insecure Direct Object Reference to Restricted Mailbox Tickets via 'on_behalf' Customer Portal Parameter
- ID
- WPSEC-2026-0796
- Plugin
- Fluent Support – Helpdesk & Customer Support Ticket System (fluent-support)
- Affected
- from 1.7.80 before 2.4.5
- Remediation
- Update to 2.4.5 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N
- Weakness
- CWE-639
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-12
- Attack surface
- Fluent Support – Helpdesk & Customer Support Ticket System on WPSec AttackSurface
- Fix released
- Published
Description
The Fluent Support – Helpdesk & Customer Support Ticket System plugin for WordPress is vulnerable to Insecure Direct Object Reference via the 'on_behalf' parameter of the Customer Portal REST endpoints in versions 1.7.80 to 2.4.0, due to the portal not checking that the acting agent may access the ticket or mailbox involved. This makes it possible for authenticated support agents who hold the sensitive-data and manage-all-tickets permissions but are restricted from certain mailboxes to view, list, reply to, close and create tickets in those restricted mailboxes by acting on behalf of the ticket's customer.
References
- https://wpsec.com/vuln/WPSEC-2026-0796/
- https://plugins.svn.wordpress.org/fluent-support/tags/2.4.5/
- https://wordpress.org/plugins/fluent-support/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS